|
|
Info |
Last Modified |
| 5 months ago |
|
|
|
|
Description |
Zeus Web Server contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when adding specific characters at the end of an URL pointing to a CGI script, which will disclose the source code of the CGI script resulting in a loss of confidentiality.
|
|
Classification |
Location:
Remote/Network Access Required
Attack Type:
Information Disclosure
Impact:
Loss of Confidentiality
Exploit:
Exploit Available
OSVDB:
Web Related
|
|
Technical |
The following suffixing characters have been reported to shows the vulnerability :
%G0
%W0
%EW
%FG
%UW
%VG
%00
|
|
Solution |
Upgrade to version 3.3.5a or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.
|
|
Products |
|
Zeus Web Server
 |
3.3.4 |
3.3.3 |
3.3.2 |
3.3.1 |
3.3 |
3.1.9 |
3.1.8 |
3.1.7 |
3.1.6 |
3.1.5 |
3.1.4 |
3.1.3 |
3.1.2 |
3.1.1 |
|
|
|
|
|
|
Credit |
- Vanja Hrustic - vanja
 relaygroup.com -
|
|
BlogsProvided by Technorati
|
None found at this time
|
|
|
